LDAP does not authenticate

[svdvonde]

Hi

Thank you for putting together this project. I think I have installed and configured the project correctly, but my project does not seem to authenticate against LDAP. The overleaf login form displays "Your email or password is incorrect." (it's not).

Here's how I set up the project:

~/overleaf-cep/<this repo>
~/overleaf-toolkit/<overleaf's community edition repo

In ~/overleaf-cep/server-ce I ran make to build both base & community.

In ~/overleaf-toolkit/config I added docker-compose.override.yml which is simply:

version: '2.2'
services:
    sharelatex:
      image: sharelatex/sharelatex:ldap-tc

In ~/overleaf-toolkit/config/variables.env I added a section for LDAP authentication:

#################
## LDAP for CE ##
#################
LOG_LEVEL="debug"

EXTERNAL_AUTH=ldap
OVERLEAF_LDAP_URL=ldaps://my-ldap-domain:636
# OVERLEAF_LDAP_STARTTLS=true
# OVERLEAF_LDAP_TLS_OPTS_CA_PATH=[]
OVERLEAF_LDAP_SEARCH_BASE=ou=People,dc=vub,dc=ac,dc=be
OVERLEAF_LDAP_SEARCH_FILTER=(|(uid={{username}})(mail={{username}}))
OVERLEAF_LDAP_EMAIL_ATT=mail
OVERLEAF_LDAP_FIRST_NAME_ATT=givenName
OVERLEAF_LDAP_LAST_NAME_ATT=sn
OVERLEAF_LDAP_NAME_ATT=cn
OVERLEAF_LDAP_SEARCH_ATTRIBUTES=["uid", "sn", "givenName", "mail"]
OVERLEAF_LDAP_UPDATE_USER_DETAILS_ON_LOGIN=true

OVERLEAF_LDAP_PLACEHOLDER='SOFT LDAP username or email address'

OVERLEAF_LDAP_ADMIN_SEARCH_BASE=cn=admins,ou=Group,dc=vub,dc=ac,dc=be
OVERLEAF_LDAP_ADMIN_SEARCH_FILTER='(member={{dn}})'
OVERLEAF_LDAP_UPDATE_ADMIN_ON_LOGIN=false

This configuration looks correct to me, and on my own machine I can run a basic ldapsearch to check whether results are returned (they are):

ldapsearch -x -H "ldaps://my-ldap-domain:636" -b "ou=People,dc=vub,dc=ac,dc=be"

There is nothing in the logs to indicate that something is going wrong (checked via bin/logs -f filestore docstore web clsi). When I try to log in, I see ordinary GET and POST requests for /login/ but no errors.

As a side-note, I discovered that the configuration variables OVERLEAF_LDAP_ADMIN_SEARCH_BASE and OVERLEAF_LDAP_ADMIN_SEARCH_FILTER are mandatory, even though they are marked as optional. If they are absent then the logs will throw a JavaScript error on this line where ._groups is undefined. I do not use ldap for appointing admins.

Note that, while the LDAP configuration is active, I can still log in using an overleaf local admin account that I created at /launchpad.

[valeriop]

Hi
try with LPDAP+STARTTLS
We have self-signed ldap SSL cert, so in variables.env I set:

OVERLEAF_LDAP_URL=ldap://my-ldap-domain
OVERLEAF_LDAP_STARTTLS=true
OVERLEAF_LDAP_TLS_OPTS_CA_PATH=["/etc/ssl/certs/MyCACert.pem"]

and in Dockerfile
- ${MYDATA}/MyCACert.pem:/etc/ssl/certs/MyCACert.pem
(save a copy of your local CAcert.pem in ${MYDATA}/MyCACert.pem)
OR
copy your CA cert in server-ce/config/MyCACert.pem and rebuild docker (make build-community).

Maybe you need to add a bind user :

OVERLEAF_LDAP_BIND_DN=cn=ldapbinduser,ou=People,dc=vub,dc=ac,dc=be
OVERLEAF_LDAP_BIND_CREDENTIALS='binduserpassword'

[svdvonde]

I have tested the configuration with unencrypted LDAP and this seems to definitely work. My mistake when testing this earlier was that I had set OVERLEAF_LDAP_STARTTLS=false instead of true, but this is different from being in comments (this is slightly confusing).

LDAPS configuration is still work in progress - I will see if I can get the right certificate and report back.

[valeriop]

If I remember well, we had issues with contacts lookup (in Share menu) using this settings:
OVERLEAF_LDAP_STARTTLS=false + OVERLEAF_LDAP_URL=ldapS://ldap-server.
That was the reason I suggested you my current configuration OVERLEAF_LDAP_STARTTLS=true + OVERLEAF_LDAP_URL=ldap://
which works smoothly.
MyCAcert.pem in our case is mandatory as we have self-signed certs.
Maybe you can try:
openssl s_client -showcerts -partial_chain -connect yourldapserver:636 < /dev/null
inside container
or
openssl s_client -showcerts -verify 5 -connect yourldapserver:636 < /dev/null |awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="cert"a".pem"; print >out}'

[svdvonde]

This is the route that I was exploring at the time of writing and which worked 🎉 , but with a more primitive command that I googled which extracts only 1 certificate of the certificate chain:

echo -n | openssl s_client -connect my-ldaps-server:636 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ldaps-cert.pem

Thank you for a better method!

For others that read this discussion, what I ended up doing was to create a new directory somewhere on my system called overleaf-certificates. Here, I ran the command as suggested by @valeriop.

openssl s_client -showcerts -verify 5 -connect my-ldap-server:636 < /dev/null |awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="cert"a".pem"; print >out}'

This generated 4 certificate files: cert1.pem, cert2.pem, cert3.pem, cert4.pem.

In overleaf-toolkit/config/docker-compose.override.yml I added a volumes section to make the certificates on the host system available in the docker volume.

The syntax for this section is as follows:

volumes:
  - src/file:dest/path

Assuming that the aforementioned overleaf-certificates folder is in some directory /my-path-to/, then this results in the following docker-compose.override.yml file:

services:
 sharelatex:
   image: sharelatex/sharelatex:ldap-tc
   volumes:
     - /my-path-to/overleaf-certificates:/etc/ssl/certs

Then, for the LDAPS configuration, I used the following:

OVERLEAF_LDAP_URL=ldap://my-ldap-domain
OVERLEAF_LDAP_STARTTLS=true
OVERLEAF_LDAP_TLS_OPTS_CA_PATH=["/etc/ssl/certs/cert1.pem","/etc/ssl/certs/cert2.pem","/etc/ssl/certs/cert3.pem","/etc/ssl/certs/cert4.pem"]

[yu-i-i]

If I remember well, we had issues with contacts lookup (in Share menu) using this settings: OVERLEAF_LDAP_STARTTLS=false + OVERLEAF_LDAP_URL=ldapS://ldap-server.

Thanks for the info, I fixed it now.

[yu-i-i]

My mistake when testing this earlier was that I had set OVERLEAF_LDAP_STARTTLS=false instead of true, but this is different from being in comments (this is slightly confusing).

As far as I remember, I fixed that about two months ago. In the current version there shouldn't be any difference.

[yu-i-i]

@svdvonde, did you fix LDAP authentication using @valeriop's suggestions? Note that you need OVERLEAF_LDAP_BIND_DN and OVERLEAF_LDAP_BIND_CREDENTIALS if your LDAP server does not permit anonymous binding.

Also, thanks for pointing out the issue with OVERLEAF_LDAP_ADMIN_SEARCH_BASE. I'll look into it — it should be optional, of course.

Note that, while the LDAP configuration is active, I can still log in using an overleaf local admin account that I created at /launchpad.

This is intentional, allowing local and LDAP users to coexist.

[svdvonde]

Hi, thanks for the follow-up. Unfortunately I've not been able to figure it out yet (I also replied to @valeriop's comment). The server allows anonymous binding.

Perhaps there are some crucial parts of the code where I can add debug messages?